The cut off was wrong here. 3.7 will send a security result, but not a security reason. It also fixes the issue that < 3.7 (e.g. 3.3) supports VNC authentication as well.